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Abstract of JP200122221 8 

PROBLEM TO BE SOLVED: To obtain a high 
degree of safety against an active attack with 
respect to a ciphered sentence by a public key 
ciphering. SOLUTION: In a ciphering device 
100, M is a plain sentence having (t) bits and a 
random number generator 101 generates a (k) 
bit random number R and. a one bit random 
number (r). A function computer G102 
computes a secret key symK=G(R) by using 
the number R. Moreover, a ciphered sentence 
C1=Epk (R, r) is generated by a public key 
cipher ciphering computer 103 by using the 
numbers R and (r) and a public key pk. 
Furthermore, by using the key symK and the 
sentence M, a ciphered sentence 
C2=symEsymk(M) is generated by a secret 
key cipher ciphering computer 1 04. Then, a 
function computer HI 05 computes C3=H (C1, 
R, IVI) and C=(C1 , C2, C3) is outputted as a 
ciphered sentence. 
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F3'-A(^) 5J104 JA21 JA30 JA31 NAD2 



(57) [mm 

Bi-f-fbSS 1 0 0 V . t h' h £73 

^11/ 1 f'-y hoaic r . mmm»^G i o 

2teJ; !m&fflt^rfiit?Ms ymK = a (R) ^fP*-^ 

l>o t/-c, d^lBSnt^Bf^it^iMllO 3^1^19. R, 
rt^B3iipkfcSrjf5V-iTRf-f-3tC] =Epk (R. r) 

JLieK'^^s ymKtT-::*:Mi;^fl3v>TBiM?-rft:C2 

= symE,„K (M) t:i^-t& . ^ hiz: mmmMi^ 

HI 0 5^c:J:•3C8 =H (Cj, R, M) S-fpJSCb. C 

= (Ci , C2 . C3 ) m^:sctLriiiij-r?>. 
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(R) ^ffMt^0^i^mm.mM.^&Lt. 

±MmmS^ symKk ^AM i: ^fflv Hf #:fcC j = s 
yniE,y„K (M) Srtf^-r&SgffigtBt^Ht^iiaSC^a 

MV-iTf!f#S;C3 = H (Ci , R. M) iwm.-thm2 

R&^s:c= (Ci, c. C3) ^m^-f-^m^^-mti 

IS. 

$^x;tBf^:fcCi -Ep„ (R, r) b. .±miimRtm 

mGt^m^^XmM-^tlfzmmMs ymK = G (R) i: 
^::fcM t ij^ fi>im-^tlf^m^-^C 2 - s y m E 

.,.K (M) fc. Jifa^l^Rk±feiit#:*:CifcPicHi: 

^fllV^-Cft3S:§tt!tBf#AC3 =H (Ci. R, M) b 

^i^Kc^m^XC^ (Ci, C2, Ca) ^A*-r-&A:^j 
±f5Bf-§-S:Ci tSS«s ki:2:fflV^TSLi!cR' =D,k 

(Ci ) t:im-ti>-'Amms^^mm^^mks 

±9SSLmR. ' h iMfmO &fflV ^T|B^lt s y m K ' 

= G ( R ' ) ?rff S:-^-^^ 1 oHignW^-a t . 

JhlH$gS«s y mK ' t±iSllf-^^CC2 h ^fflV^T^A 
M ' = s y mD3y,.R ' ( Cj ) ^th^-T-f-lgS^Bf^^ 

i!tHi;SrfflV^TBf^3tC3' =H (Ci, R, M' ) ^ff 

[lff*lI4 ] iiErascH X«x-^ 
l«icG 2: k f-y h co-r'-^ 2: s f^y h iz^T^ 9 >-r 

±iBS,iS[Rfcrei!cGi:&fflV^Timiils yniK = G 

(R) ^tmT^micom(mM.^&:t. 



yniE,„K (M) ^tfS:t-|>lf5?t«Bf^Hf-^{KaS:#® 
■ J:JaSLSScR^:±faHf^*Ci ilETjfcM Jtf aMSrH 

fcs-ffiv^tHt^xc3=H (Ci, R, M) ^sm-t^m 

imxc^- (c, C2, C3) itiitii-7^tii:b^mt^ 
±KSBt-f-^:c= {Ci, Cj, C3) 

ifBBt^S:Cji:|fS®^skfc&^V^Tai?S:R' =D,^ 
±MMMK' ■ hilBMicG t ^ffiV^TSi^^ s y mK ' 

=G(R' ) Mfm-^ms'ommmn^^t. 

JifBlS^II s y mK ' tlMmnXC^ t SfflV^T^:^ 
M'=syinD,„K' ( ) SrftfiC^^Sl^Bf#f^ 

±m^XM' bM^sm-xci b^mR' b±mm^H 

a^fflV^THf-^^tCs' =H (Ci, R' , M' ) ^ftS: 

±tBHi^S:c3 ' i:±iBHf-§-:6:C3 i: ^J:bSc-r «.J:b»x¥l5 
b t:^-t&imsMb t:mifc^b -&mmb^^«^i^ 

^ISfcG £ k t-y b <55-r'-^ & s b* y )- t^gg^-f-i. 7 

7=- A. 

^SLiSCs ( p k , s k ) ^, t 

Pk, m, r j;OBt-^:fcC = Eph (m. r ) 'W^jj 

symMi:*^'^>II&^AsymC = s ymE^y^K ( s ym 
M) 7!?ff^4,>fx. ±l0if®^symKfcBt-^:fcsyiriCfc 
*^^>^-:^s ymM=s ymDsy^K ( symC) A^'-f^^tl- 

J; •J 'i'lg^iPt^^ffli-iTBir^^fc^^-r 5Bf4^t;:*r 

Hi3^T/Gimm.bL^ 

Bf-^-fkMfltLT, T^MtSLSRJitA'r. d^iplSlpk 

i^fflV>TC3=EpK (R, r) , C2 = symE 

a(R) (M) m/C2 = H (Ci, R, M) C= ■ 

(Ci, C2, C3) ^^"^-xt-t^^t^m^Lb-rm 
itmcma \ ±mmmn ^iSM.<rj'^^ xcot-^' 

^iO-9--f Xco-T-^ t=^m-r-& 5 >':J'-A WIS i: ±|a 

^tm. (pk. sk) *^Rifflfc«}?if^<7)Wfc-r-i.t 

Pk, m,.rJ:OH&#:fcC = Epk (ni, r)*if^^, 
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symMt:d^^>l!i-^S:symC=s ymE3y^K ( s ym 
M) JLiS?i5¥^^s ymKfcBf-^^tsymCfc 

;ep^>T::*:syniM=symDgy„K (symC) 
« J: a 5rSS^ie#*»UT^$ix^^l®#:*r* o 

m-immk u-c , ^istM t mc^im r , mg^p k 

^MV->TCi =Epk (R, r) , Cj =symE 
G(R) (M) =H (Ci , R, M) ^ftjtL C 

cMximmm s k , ^^isiip k j; o r - = d,. k ( c i > 

XWM' =symD6(s- ) (Cg) ^Itff-L- C3' = 
H (Ci, R' , M' ) ^Cafc^i— itr^A^i^*^*t^iE 

iaPm G Sr k h- y h cOr- ^' s t' -y h ^c^^-fi, 9 > 

±mmn b ^ yr^^'A^G k S:fflV^Tf«ISs y mK 
= G ( R ) 1 <OM»fe?I»^Jiifc , 

ilESif^M s y m K W-^XM t Srffl V "^T Hf-^SiC 3 = s 
ymE3„K (M) *f|-^-f-Sig^iillg5?lig?-^l:?g^¥W 

±iesLi!cR t ±mm^-x c 1 1 ±m^XM trmut 

ffiV^TBt^35:C3 =H (Cj, R, M) &im-r^^2 

Bg^5cc= (Ci, C2, C3) ^ffiA-r^a5:;^^Mk^ 

[!f5R]I12] a^R, r i;^&m||pki:2-fflV>-Cit 
»§:?xf>:Hf^S:Ci=EpH (R, r) fc. iieaSScRi; 
MIScGi:$-fflV-.Ttm^fL7tS&^symK = G (R) 
t ^:3tM i; i}-hvm^ti^m'^XC 2 = s y m E 

=y»K (M) ±iasiJtRkJifBBg#3tCitra:Ht 

•■km^^X9m-^ti,t::m^-Jt:0,=n (Ci, R, M) tsCr- 
^.*-&Bf^itC= (Ci. C2. C3 ) ^A^J-r-SAAM 

±im^:zc 1 i: fig^^ s k k ^ffi V ^x^mn ' = d , k 
( c, ) ^tmrs,^Ammm^tmm^mut . 
±mmR' k±mm^G t ^m^^xmmms y mK - 
=G ( R' ) ~<s:nm-^mi<7-)mmn.mmt. 
ism^sy mK' b±m«m-xcitm^x^:sc 



M' = s y mD,„K' ( ) ^9^^^ hmmmmmu 

hffi^^tM' k hSHBf#S:Ci k±iBSLifcR' kiiai[H 
i:$^fflV^TBf^3^C3' =H (Ci, R' . M' ) 

-hiBBir^istCs '• k±iBBt^S:C3 k ^J:b*li-|.ihis^js 

k Sr^^f -f - & rzihcT^yn ^'-9 A ^ f B'lt L/Sf a-ftiSE*. 
[ lt*Jl 1 3 3 ±15 WH ^^iMco^-i XWt- ^ 

IBRIiicG S: k b'-y hco^-^^ & s b'>y b iz^mt& 9 >- 
if'A^l^k-tSikSrmk-r-S.iisffill IXJil 2tE 
IKcorn^- 7 A &IE'IS tf^fa«fr„ 

[00 0 1] 

I.Rt-^£^x-rA. 2SLt/"Bi^-(t^g. fl-^^ST-fflV^^fL 
i.rai?'9A?&t2'|tL/cf21S^#:^^Mf ■&iOT-S>'l.o 
[0002] 

[^M*«Otgfff] BS#i*{4i^51^Bf^i^x-r-J.k 
4i-|H;iSf^^^7^A(r)-a^ic^j3ijT^ I.. i^PjH«^ 
i-;^-r A{± . ^tanBf ^i^x-f AT-m k =5: r^mnmco 

6^J=fe<a-W^Bf^t UT. USA B*-^, HabinBf-^, ElGamal 

[0003] :.fihwm^<D 1 -hmwai Bi#. 
mnmtm^ (itnEiGamai et-^) >&kii. 'sm^m 

[0004] ^^-x^zM-r^^-^mm^zi^i,^ <'A-nx 
^mmmbtmmmb-mi , ^mm-^mbii. ijc 
i^^^mz'smxb^j^mmwij-^^-x^mm.-t^ ^bx- 

m^x^jEMio^mmi^z^^i^x t -5 i k t/x^ %> , 
mmmT-m^zn vx h 'kM^m^-t^^^m^-^ h:ib\±. 

10 0 0 5] ffi*. RSA Hf -f-cT^i -3 ^fi^SD^Uf^tcat 

k LT^i. Bellare , Rogaway ^Cj;?.OAEP (Optimal As 
ynmietric Encryption Padding ) b\^d:}f&ti'^^ttX 
V s§ (M. Bellare aad P. Rogaway, "Optimal Asymmet 
ric Encryption —How to encrypt with RSA" Advance 
s In Cryptology -EUROCRYPT' 94, LNCS, Springer -Ve 
rlag,1995. ) , yyVM^Mm mz.ll. SH 

A -■^£b-COJ.\-v>':xmWlX'h'0. ^coa.#:«*^m?fe{i± 

^■x\zmm ) ^ 2 swfflv ^T^-t-s ^iST'* s . 

[0006] 
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[0007] ^wm. (5i*Bi# 

J; ^ fc-^-l, i: S: Bfi^Ji: LT V-^S . 
[GOGS] 

10 1) k, JrtBSLiScR, r t^^IMp k h ^fflViTBt 

-f-3tci=Epk (R, r) t:§m-t ^i^mmmmm^t 
mn^^Si m^Jtmm^mm'^^mn^i 03) ±m 
nMRtmrnGb^m^-^xm^s ymK=G (r)^ 
nm-t^m 1 commm^^m ( mmmMMMo 102) 

= symE3y„K (M) ^Mm-T tfmmi^^^^'imM. 
#s ( nmm:imm-itmM^ 1 0 4 ) t . ±iaam 

R i:±fBBi-^:S:C 1 i:±fe^:S;Mi: W^H fc ^MV ^THf 
#*C3 = H (Ci, R, M) &tf»-r-g.^-2co|li!c?8Sr 
^■m ( lB]M?iSc?g^#iH 10 5) t . Bi^ZJtC = ( Ci , 

[0009] :^^m^z^ hm^mmii. ^m^^^^tmm 

(.wskmrnrnm^m^m^^ 0 1 ) t , ±feam 
( R ' ) s- fts-r s 1 <^mmm-m& ( i«]^ic jt^is 

G2 0 2) ±iB»@symK' hilBBS^^C^ 

03) fc. ±ieT:^M' t±ieBt^3tc2tsLifcR' h 

«Hfc^JlV>TBf-^:!tC3' =H (Ci, R' , M' ) 

, [0 0 10] ^WmzXm^i^XT-J^\%. gLicR, r 
ki:^fflV^THg#::S:Cl=E,k (R, r) ^ff^-Tix^ 

v>T^0^symK-G (R) ^mm-^mic^mmM 

k , ±iBlg-^IS s y m K k ^S:M ^ffl V Hf^ 

3^c2=symE3„K (M) ^tmi-^mmmm^m^ 

MtlllifcHtlrfflViTBt^I^Ca^H (C^. R, M) S: 
fc. ±mm^-Jcc= (Ci, C2, C3) i&Tc^j-tSA:^ 



R' =D3K (Ci ) ^ft^i-§iJMfiffiBi-§-fi-^^is:#a 

fc. iieSLmR' i:±fB|li.aGfc^fflV^Tig^sym 

K' =G (R' ) &it^-r^m3oii§iSc?i»:.wi mm 

^^t»^G20 2) t..±mmmsymK' tilBBf 
-^^CCzkSrfflUT^lXM' =symD„„K' (Cj) ^ 
fl-^l-^lg^^^Bf^m^MS^Si:. ±IB¥:fcM' i± 

=H (Ci, R' , M' ) m-m-hm4(omm:mM.^ 

m (^M^^S^H2 04) t. ilBBf^ACs' kBf 

[0011] ^mmzxMm-iimit. mtw-x (uf^ 

cDi*t^ct^:&,-fc#) , r^SLSSc, (Pk, sk)^<Kri3 
.iSh|g«fiOMk-r§i:§=, pk, m, i-j:DBf^:S;C 
= E,k (m, r) ;^i#A.tL^i5^r4^li»f-^, ^feV 

= symE,„K (symM) *f-f'^/i>:fx, JilEll^Ms y 
riiKtm^XsymCbi}''h'¥--Xs ymM=symD 
,„K ( s y mC > m'^^^fil.i.o 'Srf,iJ^^Ht-§-Srfflv>-C 

lffl^Spk^ffiViTCi=Ep,, (R, r) , C2 = symE . 

5(R) (M) Xt/'C3=H (Ci, R, M) S-ikjSt C = 
(Ci, Cj, C3) &Eg-^S:t-r-l.4)t7)T-*So 
[0012] *^BJt- _hfaB|r^:^j£t 

sk, &iHlip kJ;>5R' =D,k (Ci) S.tNVM' = 
symDs(R- ) ( ) grftfllL Cg ' =H '( Cj , 
R' , M' ) kc.,ki)<-m'i>ti-k:oi}-^mEV. - 

[0013] ^?%m^zx^^y'u^'7j^mm\^fzw&mm 

R, ri:i5rifli|pktSr|gV^TBf^^Ci=Epi, (R. 

r) ^im-r§<i.^iFi«Bi#Bt^'fb?m^Maj:. iiaa 

l^rfcRhPmGttrffll/^TtJfSils ymK = G (R) ^f-f- 

»:i-^>^ 1 wMi5r«fl:¥«t . ±fa*g^® s' y mK b^ 

S:Mk^H\,^TBf^:3fcC2-symE„„K (M) 

■ti>imm9i^m^^mM-mub . ±mtmRb±mm 

•^*C, i:_hlBT:3S:M kPgiicH k trm^-^XvmXC 3=1-1 

(Ci, R, M) mM--r&m2^mmm»mub . m 

-^5tc= (c,, Cz, C3) ^ill:t)-f-^tli;f:^JilH.i:2rl? 
tT-f- g. 7t i6 £07' D ^"5 A trlB'li L ;t t COT* ^ , 
[0014] 2^f|03t3i:l>fl!ieDro:f^5A^IB'ltLjtiQ 

^XC== (Ci, Cj, C3) ^A:^-^§A:fciM3ai:, Jb 
IBBg-^^tCitlB^asktSrlBv^TSLiScR' =D 

.k (Ci) m»-t?>^Ammzf^m-imn^mb . ± 

iBSiaR' tilBlllifcGt^fflt^-CWlsymK' = 

G (R' ) ^nm-ti>mi<ommm^^mt. ±mm 
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i^Hii^fflV^rBt-^SlC,' =H (Ci, R' . M' ) * 
[0 0 15] 

fcifetijBji-r^. :^mm(^mMi±^ —m'o^^j^mmm-^ ■ 
[ 0 0 1 6 ] 121 1 i,i-^mm^mmi>~iz.i^mmBmim 

v^Ttiif^-fE^Sl oo&^-tyn-y;?EI. H2{±ai-§-^fc 

^2 0 0 ^7]<t-/ti >y f'M'Vht . Jiiang#-ft;^a i 
0 ojat^^#^a2 0 o i,zii K)Bmiy:K'r-^-^^m^'^ti 

[ 0 0 1 7 ] m^-^mmRx/m^mBi,z-o^^xm 

(pis:, sk) ^'ik^mtm^McOMfti'k^. 
HS^lfccfi, c=Ep, (m, r) T-fSlf l> , ffi 

[0 018] i/^e. *l>ig^liDf^&{S^-r-S„ ifiOffi. 

•f-Uts ymC = s ymE„,„K ( R y mM ) ;&^-f'^feil, ^ 
^C, ?-{}^-i^3 ymKi;ag^:$:3 yrnCA^^j-TOts ymM 
= symD„„K (symC) -/j^lM-^^tll , s 

[0 0 1 9] ^/S, .HS:ffStO-r-^X(7)T-:5'^#^£?) 

[0020] S-r. SI cODf-f-ft^ai 0 OtCl-SBir^ 
X^:Mb-t^. a^^H 1 0 1 i I? k e->/ N<55SLilcR 

G 1 0 2^=J; iJiLfcRS-JflViTlffflgs ymK=G 

(R) &fi-S:-r-i. . 

[002 1] ^/t. ■i^mmm^m'^-itmM^ los i,z± 

laaiScR , r i: i^lHltp k i: ^Xtl LX ag-f-^IC i = E 

til 0 4 J:fgM t gB^«j:^G 1 0 2 TtmS ^Xfc 
M^Ma ymKi:'lrA:t)L, Hf^:^C2 = s ymE^^^ 
(M ) Sr^-t^ , S ^>fc. P^Sfc?«»^H 1 0 5 te, 

reig|iit^Bt^<b«^fli 0 3 •cft«snfe±feBi-f-S:c 



M) SritacL. C= (Ci, Cs, Cs) trSm:Scb LX 
[0022] m2cr)m^-^W:2 0 0 i hU^^ 

mz-^\^xmmth. m2^zi5\^x. 'imms.2oot,z 
BS-^-fiiSsi 0 ox&^^fifzm^-xc= (Cj. 

ll<^ski:Cii:*»(i>fl^R' =D,, (Cj) ^tf 
»-r«.. »:lc, 5g8S^S:|fG2 0 2icj;0±idR' £M 
»'-'T?^^syinI<:' =G (R' ) ^tm-T^ , 
S}^^Bf-^m-¥-i!S3?Sl2 0 3{±. IMSmm s y mK ' 

[0023] mz. mmmm^u 2 o 4 d±ib 

Ci, R' , M' X^m^-XC^' =H (Ci, R' , 
M' ) ^ifm-^, <Xi<z^ ib«SS2 0 5trJ:i3. ±tac 
3' to-fit Bf^-ffcgSl O Oii^t>X-)J-^flfzC^ff^m.bi)^ 

HiitB^t^v^ (4>t<tt. rt^^iiE:;^^^^^ (n 

IBM' ^7co-T:3S:Mfe tTm:ti-f-|>, 
[ 0 0 2 4 ] i CO J; d \z-immcommi<zktiit. 5 i^^- 

[ 0 0 2 5 ] § fefc. f|»f ^ ( s y mEsy^K . s y 
mD,„,K) S.V|igStG, llcoMSS**, i^fM^lni^- (E 

[ 0 o 2 6 ] i^i , *^JSco^,^fci snf -^-(bilg i o o 

[ 0 O 2 7 3 

mmco^M] i^xtmmLfzXdi,z:^^miz±ixif, m 

[^13 4^Bgco^coj^SSt= i: t Hrf-ffc^ 100 
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[H2] *%BHcoiafe(?5?gMtJ;*m-^^«2 0 0co M ^S: 

100 m^iimm 
102 mmrnxma 



1 0 3 'j>mmmmm^tm»s^ 
10 4. ^M»t-^ wt^»si 

105 KSvSSIiH 

, C3 Bf^iS: 



20 0 fi-§«a 

2 0 1 ^>rJ«iBf 
20 2 R8iC?i»SG 

20 3 mmmmm.^-mM^ 

2 04 |l5i!riidS«H 
205 

sk %i!wm 

symk' 



ami 



